Privacy Notice & Data Policy
The short version
- We collect only what we need to sell and deliver your food: your name, phone number, delivery address, your orders, and an email address if you choose to give one.
- We never see your card number, CVV or Mobile Money PIN. Paystack processes payments and tells us only whether a payment succeeded.
- We use your phone number to send sign-in codes and order updates. We send marketing only if you opt in.
- We share data only with the people needed to complete your order: Paystack, our SMS provider Sailup, and our delivery team. We do not sell personal data.
- We use only essential cookies, with no advertising or tracking cookies.
- You can download your data, correct it or delete your account yourself under Account → Profile.
1. Who we are
[Company legal name — set LEGAL_COMPANY_NAME], trading as Ntintan Groceries (registration number [Registrar-General company number — set LEGAL_REG_NUMBER], [Registered office address and GhanaPost GPS — set LEGAL_ADDRESS]), is the data controller for personal data processed through the Ntintan Platform. We are registered with the Data Protection Commission of Ghana under number [Data Protection Commission registration no. — set LEGAL_DPC_NUMBER].
We process personal data in line with the Data Protection Act, 2012 (Act 843) and other applicable Ghanaian law. For privacy questions, contact [privacy email — set LEGAL_PRIVACY_EMAIL].
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, mobile number, optional email address, account type (household, restaurant, school, farmer), terms acceptance date, marketing choice | You |
| Orders and delivery | Products, quantities, prices, region, town, address or GhanaPost GPS code, landmark, delivery time slot, delivery notes, order status, and for orders containing alcohol, your confirmation that you and the receiver are 18 or older | You and our systems |
| Payments | Payment method, amount, Paystack reference, payment channel (e.g. mobile money), success or failure, refund status. Not card numbers, CVV, Mobile Money PIN or bank logins. | Paystack |
| Ogya wallet and coupons | Wallet balance and transactions; coupons you buy, including the recipient's name, phone number and your message | You and our systems |
| Enquiries | Restaurant, school-feeding, farmer and quote forms (organisation, contact person, phone, region, needs, pupil numbers, farm size, produce); newsletter email | You |
| Communications | SMS we send you (sign-in codes are never stored), delivery status of those messages, support conversations | Our systems and Sailup |
| Technical and security | IP address, browser or device type, the time of requests, sign-in events, error and security logs | Your device and our systems |
For deliveries containing alcohol, the rider looks at the receiver's ID to check their age. We do not copy, photograph or store the ID document.
We do not ask for or knowingly collect special personal data (such as health, religion, ethnic origin or political opinion) and do not track your precise location.
You must give us your phone number and delivery details to place an order, because we cannot sell to or deliver to you without them. Your email address is optional.
3. How we use it and why
| Purpose | Lawful basis under Act 843 |
|---|---|
| Create and secure your account, and sign you in with one-time codes | Performing our contract with you; protecting your account |
| Process, pay for, deliver, track and support your orders, including refunds | Performing our contract with you |
| Run your Ogya wallet and coupons, and send coupon codes to recipients | Performing our contract with you |
| Reply to quote, supply, school-feeding and farmer enquiries | Steps you asked us to take before a contract; our legitimate interest in responding |
| Prevent fraud, abuse and security incidents; keep audit logs | Our legitimate interests and legal obligations |
| Keep financial and tax records | Legal obligation |
| Send newsletters, offers and harvest updates | Your consent (you can withdraw it at any time) |
| Improve the Platform (for example, which products are searched for most), using aggregated data | Our legitimate interests |
We do not use automated decision-making that has legal or similarly significant effects on you.
4. Sign-in codes and SMS
We send one-time sign-in codes and order, refund and coupon messages by SMS through our provider, Sailup, which receives your phone number and the message text only to deliver it. Sign-in codes are stored only in a scrambled (hashed) form, expire after 5 minutes, and are deleted within 24 hours. We never store the code itself in our message log.
Ntintan will never call or message you to ask for a code. If anyone does, it is not us.
5. Marketing
We send marketing messages (offers, newsletters, harvest prices) only if you have opted in, either when you create your account or by subscribing to our newsletter. You can opt out at any time in Account → Profile or by contacting [privacy email — set LEGAL_PRIVACY_EMAIL]. Order and account messages are not marketing and will still be sent.
7. Processing outside Ghana
Some of our providers may process data outside Ghana. Our servers are hosted in [hosting country — set LEGAL_HOSTING_LOCATION], and payment and SMS providers may use systems in other countries. When this happens, we choose providers that keep data secure and confidential, under contracts that require them to protect it at least as well as Ghanaian law does.
9. How long we keep your data
| Data | Kept for |
|---|---|
| Sign-in codes | Deleted within 24 hours |
| Sign-in sessions | 7 days, or until you sign out |
| SMS message log | 12 months |
| Enquiry and newsletter forms | 24 months, or until you ask us to delete them |
| Security and audit logs | 24 months |
| Account details | While your account is open. When you delete your account, your name, phone, email and addresses are removed straight away. |
| Orders, payments, wallet and coupon transactions | Six years for accounting and tax purposes. Records linked to a deleted account are kept without your name, phone, email or address. |
10. How we protect it
Our safeguards include:
- encrypted connections (HTTPS) and strict browser security policies;
- one-time codes stored only in hashed form;
- staff passwords stored with strong hashing, plus two-step sign-in for staff;
- role-based access, rate limits and account lockouts;
- audit logs of sensitive actions, and regular backups.
No system is perfectly secure. If a breach is likely to affect you, we will tell you and the Data Protection Commission as soon as reasonably practicable, as Act 843 requires.
11. Your rights
Under the Data Protection Act, 2012 (Act 843), you can:
- Access your data. Download a copy any time in Account → Profile → Download my data, or ask us.
- Correct it. Edit your name, email and account type in Account → Profile, or ask us to correct anything else.
- Delete it. Use Account → Profile → Delete my account. We keep only what the law requires, without your identity (see section 9).
- Object or withdraw consent. Turn marketing off in your profile, or object to other processing by contacting us.
- Complain to the Data Protection Commission of Ghana (dataprotection.org.gh) if you are unhappy with how we handle your data.
To exercise a right that isn't available in your account, contact [privacy email — set LEGAL_PRIVACY_EMAIL]. We may need to confirm your identity, usually by sending a code to the phone number on your account. We will reply promptly and within the time the law allows.
12. Information about other people
If you give us someone else's details, for example a coupon recipient or a person receiving your delivery, please make sure they are happy for you to do so and know about this notice. We use their details only to deliver the coupon or order.
13. Children
The Platform is for adults aged 18 and over. We do not knowingly collect personal data from children. School-feeding enquiries come from adults acting for schools, and we do not collect pupils' personal data. If you believe a child has given us data, contact us and we will delete it.
14. Changes to this notice
We may update this notice from time to time. The version and date appear at the top of the page. We will tell you about significant changes through the Platform or by SMS.
15. Contact us and complaints
Data Protection Contact, [Company legal name — set LEGAL_COMPANY_NAME][Registered office address and GhanaPost GPS — set LEGAL_ADDRESS]
Email: [privacy email — set LEGAL_PRIVACY_EMAIL] · Phone: [Support phone — set LEGAL_SUPPORT_PHONE]
Version 2026-10-28.1. Read our Terms of Sale ·